feat(user-management): implement staff reference permissions for various controllers and update sidebar permissions

apps/edr-freight-api/src/common/booking-guards.ts

@@ -14,6 +14,13 @@ export const BookingStaff = (permission: string | string[]) =>
     ),
   );
 
+/**
+ * Read-only reference data (yard dropdowns, search filters): any signed-in
+ * staff. Menu/page visibility stays permission-gated in the frontend — this
+ * only lets forms populate their lookups.
+ */
+export const StaffReference = () => applyDecorators(UseGuards(JwtGuard));
+
 export const BookingView = () => BookingStaff(FREIGHT_PERMS.bookings.view);
 
 export const TrainSchedulingView = () =>